Counting points on elliptic curves
Thomas Oliver and Chris Wuthrich
Abstract
Using relatively elementary terminology, we will discuss a natural question on the number of rational
points on an elliptic curve. This will lead us to questions that are linked to the conjecture of Birch
and Swinnerton-Dyer.

Let A and B be two integers such that ∆ = −16 ·3(4A + 27B2 ) ̸= 0. Then the equation
y2 = x 3 + A x + B

We count points in the projective plane over Z/QZ ,which means the triples (X,Y, Z) where there is nodivisor m > 1 of Q dividing all three and scalar multiplication by an integer coprime to Q does not alter thepoint. We could instead count the number of solutions(x, y) ∈ Z/QZ to the equation(1)

is called an elliptic curve. More precisely,E:

Y 2 Z = X 3 + A XZ 2 + B Z 3

y2 ≡ x 3 + A x + B

is a smooth projective cubic curve defined over Q inthe projective plane P2 .
Together with its unique point O = (0 : 1 : 0) at
infinity, it is an elliptic curve. The arithmetic of elliptic
curve has attracted lots of interest, partly due to the famous conjecture by Birch and Swinnerton-Dyer. Theaim of this text is to present some conjectures and questions formulated with as little technical terminology aspossible. This is a comparable to Zagier’s article [9],but we develop things in a different direction.

(mod Q)(4)

but we would miss not only one point, but Q/ ∏ p|Q ppoints. By the Chinese remainder theorem, M is amultiplicative function: if Q and Q′ are coprime thenM (Q · Q′ ) = M (Q) · M (Q′ ).

3. An initial conjecture
We formulate a first conjecture:Conjecture 1. For each T > 1 set Q = T !. The sequence
Q · N (T )2(5)M (Q)

1. Points of bounded heightThe set E(Q) of points on the elliptic curve with rational coordinates (X : Y : Z) consists of the one point
O and of those of the form (x : y : 1) with (x, y) ∈ Q2
satisfying the equation (1). Since projective coordinates can be scaled, we can write any P ∈ E(Q) as(X : Y : Z) with integer X, Y , Z such that no m > 1 divides all three. Up to sign this representation is unique.
Therefore the quantity
H(P) = max |X|, |Y |, |Z|

This seemingly harmless conjecture is actually avery strong statement and, to be honest, maybe eventoo much to hope for. We can already note that it
would not be true if ∆ = 0.

is a well-defined integer for each P ∈ E(Q), called theheight of P.
Let T be a large integer. We defineno
N (T ) = # P ∈ E(Q) H(P) < T ,(2)is independent of Q as long as ∆2 | Q and the prime
divisors of Q are exactly all primes below T .

converges to a positive real number as T → ∞.

Lemma 1. Let T > 1. The fraction
QM (Q)

Idea of the proof. Let p be a prime smaller than T .
Because M is multiplicative, it is enough to show thatM (pk )/pk is independent of k as long as k is large
enough for all p | ∆. First if p ∤ ∆, then using the multidimensional version of Hensel’s lemma, one can showthat M (pk ) = M (p) · pk−1 for all k ⩾ 1. For p | ∆,one can show that M (pk ) = c · pk−1 for some integer
c when k is large enough.

which is a finite number.

2. Points modulo integers
Let Q > 1 be any integer. We will denote by M (Q)the number of solutions (X : Y : Z) toY 2 Z ≡ X 3 + A XZ 2 + BZ 3(mod Q).

(3)
1

Counting points on elliptic curves — 2/6Figure 1. The sequence (5) for a few curves

Certainly the convergence of sequence (5) is very
slow for some curves E, but it does not look implausible either. Some examples for a few curves are illustrated in Figure 1. The jump in the graph for thecurve y2 = x3 + x + 1 is not an error.
 This is due to two43992
30699397
points (x, y) = 82369 , ± 23639903 of height 30699397,
which increases N (T ) from 9 to 11 at this T .
We learn from this that the function N (T ) grows
slowly and its jumps cause the convergence in Conjecture 1 to be too slow.

4. Counting points of bounded height
In Figure 2, there are the plots of the function N (T )for some curves. We observe that N (T ) grows likeC · logr/2 (T ) for some C and some integer r. We will
describe a concrete incarnation of this integer r.
At the heart of the reason why elliptic curves standout among algebraic curves (and why they are so useful
in applications like cryptography) is the fact that theset of points E(Q) forms an abelian group with identity
element O. The group law is constructed geometricallyusing what is called the chord and tangent principle.
About 100 years ago, Louis J. Mordell proved that forany elliptic curve defined over the rational numbers, afinite set of points suffices to obtain all points in E(Q)using this group operation. The rank r = rank E(Q)is the minimal number of points needed to create a
subgroup of finite index or, equivalently, that E(Q) isa direct product of a finite abelian group, called thetorsion subgroup E(Q)tors , and a group isomorphicto Zr .

Our observation based on the graphs of N (T ) inFigure 2 are confirmed by the following proposition.
It is also the first Proposition in [9].
Proposition 2. There is an explicit constant C suchthat# P ∈ E(Q) H(P) < T ∼ C · log(T )r/2
as T → ∞, where r = rank E(Q).
The symbol ∼ here means as usual that the fractionof the two sides tends to 1 as T → ∞. More precisely,
the difference of the two sides can be shown to be
O log(T )(r−1)/2 . The constant C is also given in [9],though it missed an extra factor 23 :C=#E(Q)tors  2π r/2
1√··3(r/2)!
R

where R = Reg(E) ∈ R is the so-called regulator of E.
If r is odd, we should interpret (r/2)! as Γ(r/2 + 1). In
Figure 2, we plotted N (T ) for some curves of rank 0,
1, 2, 3, and 4 against the prediction in this proposition.
The names like “11a1” refer to their Cremona labels
as in [3].
The proposition also implies that Conjecture 1 isequivalent toQ ·C2 · log(T )r(6)M (Q)converging to a positive limit as T → ∞ with Q as
before. If we take Q = T ! or Q = ∏ p<T p, then Q is

Counting points on elliptic curves — 3/6

Figure 2. N (T ) for some curves

exponential in T , while we compare it to N (T ) which
is logarithmic. This double exponential gap between
the two illustrates again how fragile the behaviour of
this quotient is. We plot in Figure 3 the graphs for thequotient (6) with the same curves as in Figure 1. In
this figure, we also plot the conjectured limit that weare getting to in a moment.

5. The link to the Birch and
Swinnerton-Dyer conjecture
Those who are aware of the history of the conjecture
made by Bryan Birch and Peter Swinnerton-Dyer will
now have recognised the connection between our Conjecture 1 and the rank part of their famous conjecture.
As explained in [1], their initial investigations concerned the behaviour of the productM (p)pp<T∏

as T increases. They made an initial guess that it grows
like log(T )r . Up to a factor linked to primes with p | ∆,this product is equal to M (Q)/Q. They made a better
and, in many respects more interesting, conjecture
involving the L-function L(E, s) attached to E, which
we will avoid in this exposition. Their conjecture saysthat L(E, s) has a zero of order r = rank E(Q) at s = 1
and they gave a precise formula for the leading termof its expansion at s = 1. See [8].
Goldfeld [4] established the connection between
the two versions and, as a consequence, we find thefollowing.

Theorem 3. If Conjecture 1 holds then the rank partof the Birch and Swinnerton-Dyer conjecture holds.
However, it also turns out that much more is true.
In [2], it is well explained that Conjecture 1 not only
implies the Birch and Swinnerton-Dyer conjecture, itwould also imply that the function L(E, s) satisfies theanalogue of the Riemann hypothesis in a very strong
form. Maybe too strong to believe, but there is also no
reason to disbelieve it currently.

6. The period
Number theorists like to split problems into global andlocal problems. Issues concerned with divisibility byone (or a few) primes, like the term M (Q), are local,
while rational points and their heights, like N (T ), areglobal. This terminology comes from the constructionof the completions of Q. For each prime p, there is afield Q p , called the field of p-adic numbers. It is thecompletion of Q with respect to the topology given by
the distanced(x, y) = |x − y| p = p−kfor x, y ∈ Z,

where pk is the largest power of p dividing x − y, extended to Q by |a/b| p = |a| p /|b| p . Together with themore commonly known completion R with respect tothe usual absolute value | · |, they form all possible
completions of Q.
Let T > 1 and take Q as before. Let ε = p−k wherekp < Q ⩽ pk+1 . To say that (4) holds for (x, y) withCounting points on elliptic curves — 4/6

Figure 3. Convergence of the limit of (6) for some curves

integer x, y can now be formulated by asking that−y2 + x3 + A x + B p < εfor all p < T . The quantity M (p) is then linked to thearea in Q p × Q p satisfying this inequality.
It is therefore natural to look at the equivalent inequality over the real numbers R. Consider (x, y) ∈ R2
such that−y2 + x3 + A x + B < εfor some small ε > 0. Assume that ∆ < 0, whichmeans that the graph of E(R) is connected containing
only (x, y) with x bigger than the unique solution e1of x3 + A x + B = 0 in R. The area of this part of theplane R2 is given byZ ∞ p
p
2x3 + A x + B + ε − x3 + A x + B − ε dx
e12ε
√
√dx
e1x3 + A x + B + ε + x3 + A x + B − εZ
 dx
= 2ε ·+ O ε2E(R) 2|y|Z ∞=2The same result holds when E(R) is formedof two conR
nected components. The quantity Ω = E(R) dx/(2|y|)is known as a period of E. One can consider Ω · M (Q)to be linked to the area of the subset of R2 × ∏ p<T Q2p
cut out by the inequalities above.

7. Limit
Because Conjecture 1 is linked to the rank part of theBirch and Swinnerton-Dyer conjecture, the limit ofthe quotient (5) should have something to do with theleading term of the function L(E, s) at s = 1.
Theorem 4. Suppose Conjecture 1 holds. Then theBirch and Swinnerton-Dyer formula holds if and onlyif
 3eγ r
1
Q · N (T )2· Ω · S.
=√·limT →∞ M (Q)
2π
2 · ((r/2)!)2
where S is a square integer, which is conjecturally theorder of the mysterious Tate-Shafarevich group X(E).
Oh, e and γ are both constants due to Euler. InFigure 3 we have plotted the expression (6) against
this limit for the curves in question.
It remains to explain what the Tate-Shafarevichgroup X(E) is. It is a torsion abelian group, whichis conjectured to be finite. The group X(E) can also
be viewed as measuring a discrepancy between a local
and a global questions. Its elements can be viewed ascurves C defined over Q which become isomorphic
to E when considered over any p-adic field as well
as over C. This group appears as an obstruction toeffectively calculating E(Q) by the method of infinite
descent.

Refined counting of points modulo
primesOne of the vague arguments given initially for theconjecture is the following: If we have lots of points
with integer (X : Y : Z), then they produce lots of points

Counting points on elliptic curves — 5/6

modulo integers, and primes in particular. In otherwords the larger r, the more often M (p) should beabove average. This is however too simplistic.
But, what is this average? Hasse proved that p +√√1 − 2 p < M (p) < p + 1 + 2 p, which suggests p +1 as the average. We define
a p = p + 1 − M (p),where negative values of a p indicate an excess ofpoints modulo p.
Originally conjectured by Sato and Tate, the values√
a p /(2 p) ∈ [−1, 1] are known to satisfy a precise distribution, which is independent of r. See [6] for a goodoverview. In particular positive and negative values
should appear with the same frequency. Except forthe special elliptic curves with extra endomorphisms√(complex multiplication), the distribution of a p /(2 p)
looks
like
this:
The red histogram on
top is for the curve A =B = 1 for which E(Q)is infinite and the bottom in blue is for A = 1,
B = 2 which has a finite
E(Q). For both we used
all primes p ⩽ 107 .

Murmurations
Finally, we present a recently discovered phenomenon
related to counting points on elliptic curves.
The reduction of an elliptic
curve curve at a prime p canbe bad in that the reduced
curve has a singularity. There
are two possibilities: On theleft, we have the case of nodal
reduction and, on the right,that of cuspidal reduction.
The conductor N(E) of an elliptic curve E definedover Q is an integer divisible only by the primes ofbad reduction. In other words, the conductor may bewritten as a product
N(E) = ∏ pe p .

as a function of p, where E varies over a suitable finite
set of elliptic curves [5]. More precisely, we set:ME ,r (p) =where r ∈ Z⩾0 , E is a finite set of elliptic curves overQ, and E (r) is the subset of E containing its curvesof rank r. In Figure 4 below we plot ME ,r (p) against
p for even r (blue) and odd r (red), where we take E
to be the set all elliptic curves defined over Q with
conductor in the interval 217 < N(E) < 218 . Most ofthese curves have either rank 0 or 1 and so the blue
dots correspond to curves with a finite E(Q) and thered for infinite E(Q).
In forthcoming work of He, Lee, Oliver, Pozdnyakov, and Sutherland, this oscillating behaviour isshown to hold for elliptic curves with much larger conductor, and also for related arithmetic objects such as
modular forms and genus 2 curves. There is some initial progress to the understanding as to why this pattern
appears due to Zubrilina, but there is no comprehensive
explanation for this phenomenon so far. Since mostcurves in the interval are of rank either 0 or 1, andbecause the total average should be 0 by the Sato-Tatedistribution, we expect the two waves of murmuration
to be complementary. The naive heuristic that curvesof rank 1 have more points modulo prime, and hencea p is more frequently negative, may be the reason thatthe red wave dips initially for small primes p.

References[1]

B. J. Birch, Conjectures concerning elliptic curves,
Proc. Sympos. Pure Math., Vol. VIII, Amer. Math.
Soc., Providence, R.I., 1965, pp. 106–112.

[2]

Keith Conrad, Partial Euler products on the criticalline, Canad. J. Math. 57 (2005), no. 2, 267–297.

[3]John E. Cremona, Algorithms for modular ellipticcurves, second ed., Cambridge University Press,
1997, Now available at lmfdb.

[4]

Dorian Goldfeld, Sur les produits partiels eulériens
attachés aux courbes elliptiques, C. R. Acad. Sci.
Paris Sér. I Math. 294 (1982), no. 14, 471–474.

[5]

Y.-H He, K.-H Lee, T. Oliver, and A. Pozdynakov,Murmurations of elliptic curves, arXiv: 2204.10140.

[6]

Barry Mazur, Finding meaning in error terms, Bull.
Amer. Math. Soc. (N.S.) 45 (2008), no. 2, 185–228.

[7]Louis J. Mordell, On the rational solutions of theindeterminate equations of the third and fourth degree, Math. Proc. Cambridge Philos. Soc. 21 (1922),179–182.

p: badMore precisely, for a bad prime p ∈/ {2, 3}, we havee p = 1 (resp. e p = 2) if E has a nodal reduction (resp.
cuspidal reduction) modulo p. For p = 2 and 3, therecipe is known but more complicated.
The so-called murmuration phenomenon refers to
the oscillating behaviour of the average value of a p (E),1∑ a p (E),#E (r) E∈E(r)Counting points on elliptic curves — 6/6

Figure 4. Figure 4: Murmuration with even rank curves in blue and odd rank curves in red.
[8]

Andrew Wiles, Birch and Swinnerton-Dyer Conjecture, Clay Mathematics Institute.

[9]

Don Zagier, The Birch-Swinnerton-Dyer conjecture from a naive point of view, Arithmetic algebraic geometry (Texel, 1989), Progr. Math., vol. 89,
Birkhäuser Boston, Boston, MA, 1991, pp. 377–389.